PANW-AG-000015 - The Palo Alto Networks security platform, if used to provide intermediary services for remote access communications traffic (TLS or SSL decryption), must ensure inbound and outbound traffic is monitored for compliance with remote access security policies - TLS/SSL must monitor traffic.

CAT|II

CCI|CCI-000067

Rule-ID|SV-228832r557387_rule

STIG-ID|PANW-AG-000015

STIG-Legacy|SV-77037

STIG-Legacy|V-62547

Vuln-ID|V-228832

PANW-AG-000016 - The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.

CCI|CCI-000068

Rule-ID|SV-228833r557387_rule

STIG-ID|PANW-AG-000016

STIG-Legacy|SV-77039

STIG-Legacy|V-62549

Vuln-ID|V-228833

PANW-AG-000017 - The Palo Alto Networks security platform that stores secret or private keys must use FIPS-approved key management technology and processes in the production and control of private/secret cryptographic keys.

Rule-ID|SV-228834r557387_rule

STIG-ID|PANW-AG-000017

STIG-Legacy|SV-77041

STIG-Legacy|V-62551

Vuln-ID|V-228834

PANW-AG-000020 - The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.

CCI|CCI-001453

Rule-ID|SV-228835r557387_rule

STIG-ID|PANW-AG-000020

STIG-Legacy|SV-77043

STIG-Legacy|V-62553

Vuln-ID|V-228835

PANW-AG-000024 - The Palo Alto Networks security platform must log violations of security policies.

CAT|III

CCI|CCI-000133

Rule-ID|SV-228836r557387_rule

STIG-ID|PANW-AG-000024

STIG-Legacy|SV-77045

STIG-Legacy|V-62555

Vuln-ID|V-228836

PANW-AG-000035 - The Palo Alto Networks security platform must only enable User-ID on trusted zones.

CCI|CCI-000381

Rule-ID|SV-228837r557387_rule

STIG-ID|PANW-AG-000035

STIG-Legacy|SV-77047

STIG-Legacy|V-62557

Vuln-ID|V-228837

PANW-AG-000036 - The Palo Alto Networks security platform must disable WMI probing if it is not used.

Rule-ID|SV-228838r557387_rule

STIG-ID|PANW-AG-000036

STIG-Legacy|SV-77049

STIG-Legacy|V-62559

Vuln-ID|V-228838

PANW-AG-000037 - The Palo Alto Networks security platform must not enable the DNS proxy.

Rule-ID|SV-228839r557387_rule

STIG-ID|PANW-AG-000037

STIG-Legacy|SV-77051

STIG-Legacy|V-62561

Vuln-ID|V-228839

PANW-AG-000038 - The Palo Alto Networks security platform must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

CCI|CCI-000382

Rule-ID|SV-228840r557387_rule

STIG-ID|PANW-AG-000038

STIG-Legacy|SV-77053

STIG-Legacy|V-62563

Vuln-ID|V-228840

PANW-AG-000044 - The Palo Alto Networks security platform that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.

CCI|CCI-000185

Rule-ID|SV-228841r557387_rule

STIG-ID|PANW-AG-000044

STIG-Legacy|SV-77055

STIG-Legacy|V-62565

Vuln-ID|V-228841

PANW-AG-000047 - The Palo Alto Networks security platform must protect against the use of internal systems from launching Denial of Service (DoS) attacks against other networks or endpoints.

CCI|CCI-001094

Rule-ID|SV-228842r557387_rule

STIG-ID|PANW-AG-000047

STIG-Legacy|SV-77057

STIG-Legacy|V-62567

Vuln-ID|V-228842

PANW-AG-000049 - The Palo Alto Networks security platform must block phone home traffic.

Rule-ID|SV-228843r557387_rule

STIG-ID|PANW-AG-000049

STIG-Legacy|SV-77059

STIG-Legacy|V-62569

Vuln-ID|V-228843

PANW-AG-000050 - The Palo Alto Networks security platform must deny outbound IP packets that contain an illegitimate address in the source address field.

Rule-ID|SV-228844r557387_rule

STIG-ID|PANW-AG-000050

STIG-Legacy|SV-77061

STIG-Legacy|V-62571

Vuln-ID|V-228844

PANW-AG-000051 - The Palo Alto Networks security platform must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

CCI|CCI-001109

Rule-ID|SV-228845r557387_rule

STIG-ID|PANW-AG-000051

STIG-Legacy|SV-77063

STIG-Legacy|V-62573

Vuln-ID|V-228845

PANW-AG-000052 - The Palo Alto Networks security platform must terminate communications sessions after 15 minutes of inactivity.

CCI|CCI-001133

Rule-ID|SV-228846r557387_rule

STIG-ID|PANW-AG-000052

STIG-Legacy|SV-77065

STIG-Legacy|V-62575

Vuln-ID|V-228846

PANW-AG-000060 - The Palo Alto Networks security platform must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures.

CCI|CCI-001240

Rule-ID|SV-228847r557387_rule

STIG-ID|PANW-AG-000060

STIG-Legacy|SV-77067

STIG-Legacy|V-62577

Vuln-ID|V-228847

PANW-AG-000062 - The Palo Alto Networks security platform must drop malicious code upon detection - Antivirus Profiles.

CCI|CCI-001243

Rule-ID|SV-228848r559740_rule

STIG-ID|PANW-AG-000062

STIG-Legacy|SV-77069

STIG-Legacy|V-62579

Vuln-ID|V-228848

PANW-AG-000062 - The Palo Alto Networks security platform must drop malicious code upon detection - Antivirus Services.

PANW-AG-000063 - The Palo Alto Networks security platform must delete or quarantine malicious code in response to malicious code detection - Antivirus Profiles

Rule-ID|SV-228849r559739_rule

STIG-ID|PANW-AG-000063

STIG-Legacy|SV-77071

STIG-Legacy|V-62581

Vuln-ID|V-228849

PANW-AG-000063 - The Palo Alto Networks security platform must delete or quarantine malicious code in response to malicious code detection - Antivirus Services

PANW-AG-000064 - The Palo Alto Networks security platform must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection - Email Log Forwarding

Rule-ID|SV-228850r557387_rule

STIG-ID|PANW-AG-000064

STIG-Legacy|SV-77135

STIG-Legacy|V-62645

Vuln-ID|V-228850

PANW-AG-000064 - The Palo Alto Networks security platform must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection - Email Servers

PANW-AG-000065 - The Palo Alto Networks security platform must automatically update malicious code protection mechanisms - Download Action

CCI|CCI-001247

Rule-ID|SV-228851r557387_rule

STIG-ID|PANW-AG-000065

STIG-Legacy|SV-77073

STIG-Legacy|V-62583

Vuln-ID|V-228851

PANW-AG-000065 - The Palo Alto Networks security platform must automatically update malicious code protection mechanisms - Schedule

PANW-AG-000073 - The Palo Alto Networks security platform must deny or restrict detected prohibited mobile code - Antivirus Actions

CCI|CCI-001695

Rule-ID|SV-228852r559734_rule

STIG-ID|PANW-AG-000073

STIG-Legacy|SV-77075

STIG-Legacy|V-62585

Vuln-ID|V-228852

PANW-AG-000073 - The Palo Alto Networks security platform must deny or restrict detected prohibited mobile code - Antivirus Policies

PANW-AG-000074 - The Palo Alto Networks security platform must prevent the download of prohibited mobile code - Antivirus Profiles

CCI|CCI-001169

Rule-ID|SV-228853r559712_rule

STIG-ID|PANW-AG-000074

STIG-Legacy|SV-77077

STIG-Legacy|V-62587

Vuln-ID|V-228853

PANW-AG-000074 - The Palo Alto Networks security platform must prevent the download of prohibited mobile code - Antivirus Protocols

PANW-AG-000078 - The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must control remote access methods (inspect and filter traffic).

CCI|CCI-002314

Rule-ID|SV-228854r831594_rule

STIG-ID|PANW-AG-000078

STIG-Legacy|SV-77079

STIG-Legacy|V-62589

Vuln-ID|V-228854

PANW-AG-000079 - The Palo Alto Networks security, if used as a TLS gateway/decryption point or VPN concentrator, must provide the capability to immediately disconnect or disable remote access to the information system.

CCI|CCI-002322

Rule-ID|SV-228855r831595_rule

STIG-ID|PANW-AG-000079

STIG-Legacy|SV-77081

STIG-Legacy|V-62591

Vuln-ID|V-228855

PANW-AG-000080 - To protect against data mining, the Palo Alto Networks security platform must detect and prevent SQL and other code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

CCI|CCI-002346

Rule-ID|SV-228856r831596_rule

STIG-ID|PANW-AG-000080

STIG-Legacy|SV-77083

STIG-Legacy|V-62593

Vuln-ID|V-228856

PANW-AG-000081 - To protect against data mining, the Palo Alto Networks security platform must detect and prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.

Rule-ID|SV-228857r831597_rule

STIG-ID|PANW-AG-000081

STIG-Legacy|SV-77085

STIG-Legacy|V-62595

Vuln-ID|V-228857

PANW-AG-000094 - The Palo Alto Networks security platform must off-load audit records onto a different system or media than the system being audited - Syslog

CCI|CCI-001851

Rule-ID|SV-228858r831598_rule

STIG-ID|PANW-AG-000094

STIG-Legacy|SV-77087

STIG-Legacy|V-62597

Vuln-ID|V-228858

PANW-AG-000101 - The Palo Alto Networks security platform being used for TLS/SSL decryption using PKI-based user authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certificate Authorities (CAs) for the establishment of protected sessions.

CCI|CCI-002470

Rule-ID|SV-228859r831599_rule

STIG-ID|PANW-AG-000101

STIG-Legacy|SV-77089

STIG-Legacy|V-62599

Vuln-ID|V-228859

PANW-AG-000102 - The Palo Alto Networks security platform must protect against Denial of Service (DoS) attacks by employing rate-based attack prevention behavior analysis (traffic thresholds).

CAT|I

CCI|CCI-002385

Rule-ID|SV-228860r831602_rule

STIG-ID|PANW-AG-000102

Detections

Analytics

Revision 1.4

May 24, 2023

Functional Update